deploy/gitea: Gitea behind traefik, rproxy and servewaf, with its test (closes #178)

deploy/gitea/compose.yaml runs traefik, stock Gitea 1.27.3, rproxy and
servewaf on one network with a fixed subnet. Its containers skip
servewaf's checks; the network's gateway is left out of that range.
rproxy takes uploads of 2 GiB and 30 minutes, and cuts responses at 15
minutes. script/gitea-setup (make gitea-setup) brings the setup up and
checks it. docs/gitea.md is rewritten around the setup.

Judgement call: the Core Rule Set runs in detect mode, so it refuses nothing.
Judgement call: traefik serves its own certificate; no certificate resolver.
Partially verified: the image build failed three runs on Ubuntu's snapshot
service, so the checks ran only against a stand-in image with the same binary.

Model: deepseek-v4-pro (implementation), opus-5-5 (rework)

README.md

@@ -511,8 +511,9 @@ volumes:
     servewaf-state:
 ```
 
-[`docs/gitea.md`](docs/gitea.md) records what the defaults do in front of gitea,
-request by request.
+`deploy/gitea` holds a complete setup of gitea, traefik included, as a Docker
+Compose file. [`docs/gitea.md`](docs/gitea.md) explains it, and records what the
+defaults do in front of gitea, request by request.
 
 ### `rproxy` beside the app
 
@@ -785,6 +786,10 @@ on the host.
   Core Rule Set is known to refuse, and prints what `servewaf` did with each.
   Needs network access, and a docker daemon that pushes to a registry on
   `localhost` over plain HTTP. `make gitea-requests`.
+- `script/gitea-setup`: builds the image, brings up the setup in `deploy/gitea`,
+  and checks it as [`docs/gitea.md`](docs/gitea.md) describes. Then it removes
+  the containers, the network, the volumes and the image it built. Needs network
+  access. `make gitea-setup`.
 
 ## TODO
 
@@ -808,7 +813,8 @@ on the host.
 - [`docs/state-files.md`](docs/state-files.md): the state files and what each
   holds.
 - [`docs/image.md`](docs/image.md): what the image holds and how it is pinned.
-- [`docs/gitea.md`](docs/gitea.md): `smallwebwaf` in front of gitea.
+- [`docs/gitea.md`](docs/gitea.md): `smallwebwaf` in front of gitea: the setup
+  in `deploy/gitea`, and what the defaults do there.
 
 ## License